The short answer: Prioritize vulnerabilities by combining three signals instead of relying on severity alone. CVSS tells you how bad a vulnerability could be. EPSS estimates how likely it is to be exploited in the next 30 days. The CISA Known Exploited Vulnerabilities (KEV) catalog confirms which ones attackers are already using. Layer those signals on top of your own asset context, especially whether a system faces the internet, and you can fix the small set of vulnerabilities that create most of your real risk first.
This is the second article in our vulnerability management series. If your scans are already producing more findings than your team can close, this is where the program either gains traction or stalls.
Why can't you just patch everything rated critical?
Because there are too many of them, and severity does not equal risk. In 2025, 18,987 newly published CVEs, about 39 percent of the year's total, were rated critical or high under CVSS according to Jerry Gamblin's annual CVE review. No small or midsize IT team can treat every one of those as an emergency, and trying to do so spreads effort so thin that the truly dangerous ones wait in line with the rest.
Meanwhile, only a small fraction of vulnerabilities are ever exploited. Cyber insurer Coalition reported that its policyholders received critical alerts for just 0.15 percent of the vulnerabilities published during the first ten months of 2024. The challenge is not finding critical vulnerabilities. It is finding the few that matter this week.
What does a CVSS score measure, and what does it miss?
The Common Vulnerability Scoring System (CVSS) rates the technical severity of a vulnerability on a scale from 0 to 10. A base score considers factors like whether the flaw can be exploited over a network, whether it requires user interaction or privileges, and how much damage it could do to confidentiality, integrity, and availability. CVSS version 4.0, released by FIRST in November 2023, adds more nuance, but most scanners and vendor advisories still lead with the base score.
What CVSS does not measure is likelihood. A 9.8 in a rarely used component with no public exploit code can be less urgent than a 7.5 in a VPN appliance that ransomware groups are actively targeting. CVSS also knows nothing about your environment. The same vulnerability on an internet-facing remote access server and on an isolated lab machine receives the same base score.
Use CVSS as a measure of potential impact. Do not use it as your to-do list.
What is EPSS and how should you use it?
The Exploit Prediction Scoring System (EPSS), maintained by FIRST, the same organization behind CVSS, estimates the probability that a vulnerability will see exploitation activity in the wild within the next 30 days. Scores range from 0 to 1 and are recalculated daily using data on exploit code availability, attacker chatter, observed scanning activity, and vulnerability characteristics. EPSS version 4 was released in March 2025.
EPSS is useful for separating the large middle of your backlog. When two vulnerabilities share a high CVSS score, the one with a much higher EPSS probability deserves attention first. EPSS is also forward-looking, which helps flag vulnerabilities that are likely to be exploited soon but have not yet reached confirmed exploitation lists.
EPSS is a probability, not a guarantee, and it is not tied to your network. Treat it as one input, not a verdict.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities catalog is CISA's authoritative list of vulnerabilities with reliable evidence of active exploitation. To be added, a vulnerability must have a CVE identifier, confirmed exploitation in the wild, and a clear remediation action such as a patch, mitigation, or instruction to discontinue the product.
As of September 2026 the catalog held roughly 1,700 entries. Compared with the hundreds of thousands of CVEs published since the program began, that is well under one percent. That small size is exactly what makes KEV valuable. If a KEV-listed vulnerability exists on one of your systems, attackers have already demonstrated they can and will use it. Any KEV match on an internet-facing system should be treated as an incident-level priority.
How did CISA's BOD 26-04 change vulnerability prioritization?
On June 10, 2026, CISA issued Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk." It replaced BOD 22-01, which had given federal agencies flat deadlines for every KEV entry: two weeks for newer vulnerabilities and six months for older ones.
The new directive evaluates each vulnerability on four yes-or-no questions. Is the asset publicly exposed? Is the vulnerability in the KEV catalog? Can an attacker automate exploitation? Would successful exploitation give total control of the system? The combination of answers sets the deadline, ranging from three days for the highest-risk combinations, to fourteen days for most other KEV entries, to sixty days for lower-risk combinations, to remediation at the next system upgrade when none of the risk factors apply.
BOD 26-04 is mandatory only for federal civilian agencies. Its value for private businesses is the logic: exposure and active exploitation should drive urgency, and deadlines should tighten automatically when the facts change.
What does a practical prioritization model look like for a small or midsize business?
You do not need a federal compliance team to apply the same thinking. The model Harbour Tech uses with clients across Ohio and Indiana groups findings into four tiers.
Tier 1, remediate within 72 hours. Any KEV-listed vulnerability, or any vulnerability with a high EPSS score, on an internet-facing system: firewalls, VPNs, remote access gateways, email servers, and public web applications. If a patch is not available, apply the vendor mitigation or take the service offline until it is.
Tier 2, remediate within 14 days. KEV-listed vulnerabilities on internal systems, and critical vulnerabilities with elevated EPSS scores on servers or on systems that store regulated data such as ePHI, cardholder data, or customer financial records.
Tier 3, remediate within 30 days. Remaining critical and high findings. This window also aligns with the PCI DSS requirement to install critical security patches within one month of release.
Tier 4, remediate on the standard monthly cycle or at the next upgrade. Medium and low findings with no exploitation evidence, plus vulnerabilities on isolated systems with compensating controls.
Two rules make the model work. First, tiers are recalculated every time a scan runs or the KEV catalog updates, so a vulnerability can jump from Tier 3 to Tier 1 overnight. Second, anything that cannot meet its deadline goes into a written exception register with a compensating control, such as network isolation or additional monitoring, an owner, and a review date.
How does asset context change the order?
Two identical vulnerabilities can carry very different risk depending on where they sit. The questions that matter are whether the system is reachable from the internet, what data it stores or can access, whether it holds administrative credentials, and how much of the business stops if it goes down.
A domain controller, a core banking or practice management server, and a firewall all warrant tighter deadlines than a conference room PC. That is why an accurate asset inventory with criticality ratings is the foundation of every prioritization model. Without it, the scoring systems above are guessing.
Prioritization only reduces risk when it turns into action. The final step is a patching process fast enough to meet these deadlines and disciplined enough to prove it, which is the focus of the next article: Patch Management Best Practices for Ohio Businesses.
Common questions about vulnerability prioritization
Is EPSS better than CVSS?
They measure different things. CVSS estimates potential severity, while EPSS estimates the likelihood of exploitation. The most effective programs use both, along with KEV status and asset context.
How often does the CISA KEV catalog change?
CISA adds entries several times a month, often in batches, and sometimes multiple times in a single week. Programs should check against the catalog automatically rather than manually.
Does BOD 26-04 apply to private companies?
No. It is binding only on federal civilian executive branch agencies. CISA encourages all organizations to adopt similar risk-based practices, and many cyber insurers and auditors are beginning to reference the KEV catalog in their expectations.
What if a vendor has not released a patch yet?
Apply the vendor's published mitigation, restrict access to the affected service, increase monitoring, and record the exposure in your exception register until a patch is available.
Need help sorting your backlog?
Harbour Technology Consulting turns scan results into a clear, prioritized remediation plan for businesses across Dayton, Cincinnati, Columbus, and Indianapolis. Call 937-428-9234, email info@harbourtech.net, or contact our team.
Next in this series
Patch Management Best Practices for Ohio Businesses
Sources
- Jerry Gamblin, 2025 CVE Data Review
- Coalition Cyber Threat Index 2025
- CISA Known Exploited Vulnerabilities Catalog
- Tenable, CISA BOD 26-04 FAQ
- FIRST, Exploit Prediction Scoring System (EPSS)
